Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

What IDS signatures are available on the PIX Firewall?

Core issue

The Cisco Intrusion Detection System (IDS) functionality on the PIX Firewall is only available in PIX Operating System (OS) version 6.0 and later. However, some signatures supported in the Cisco IDS Sensor are not available in the PIX.

Resolution

The PIX lists these single-packet IDS signature messages:

  • 1000-1006      
  • 1100      
  • 1102      
  • 1103      
  • 2000-2012      
  • 2150      
  • 2151      
  • 2154      
  • 3040-3042      
  • 4050-4052      
  • 6050-6053      
  • 6100-6103      
  • 6150-6155      
  • 6175      
  • 6180      
  • 6190

The PIX lists single packet (atomic) Cisco IDS signature messages through the System Log (Syslog). All PIX IDS Syslog messages start with %PIX-4-4000nn (where nn is in the range of 00 through 51) and have this format:

%PIX-4-4000nn IDS:number string from IP_address to IP_address on interface interface_name

These descriptions define the format:

  • The number is the signature number.  
       
  • The string is the signature message, and is approximately the same as the NetRanger signature message.  
       
  • The IP_address is the local to remote address to which the signature applies.  
       
  • The interface_name is the name of the interface where the signature originated.

For example:

%PIX-4-400013 IDS:2003 ICMP redirect from 10.4.1.2 to 10.2.1.1 on interface dmz

This means that the IDS log message 400013 is for the signature "ICMP redirect", whose signature ID is 2003.

For more information on the PIX IDS Syslog messages and the commands used by the PIX to handle the signatures, refer to the Managing IDS Syslog Messages of Accessing and Monitoring PIX Firewall.

Version history
Revision #:
1 of 1
Last update:
‎06-22-2009 05:34 PM
Updated by:
 
Labels (1)
Everyone's tags (4)